DetectionsDET-002

Behavior-based detection engineering

Suspicious Run Dialog Execution Followed by Remote Retrieval

Correlates suspicious RunMRU activity with native-tool execution and remote retrieval in a short window.

Behavior

What it detects

Detects suspicious commands recorded through Windows Run when they are followed within a short window by native Windows tooling associated with remote retrieval or follow-on execution.

Engineering decision

Why this detection

ClickFix payloads change quickly. The lure, command, malware, and infrastructure can all rotate. The more durable signal is the execution chokepoint: a user is convinced to run a command, native tooling launches, and remote content or follow-on execution appears immediately afterwards.

Correlating Run-dialog evidence with process execution is stronger than alerting on a single tool name or one campaign IOC.

Signal chain

Detection logic

Suspicious RunMRU command
User-context execution
LOLBin or interpreter
Remote retrieval or silent follow-on execution
Correlation within five minutes

Primary analytic

Query

KQL and SPL express the same analytical intent using source-specific schemas.

What this checks

Find suspicious Windows Run commands and correlate them with potentially related native-tool execution on the same device within five minutes.

KQL

let correlation_window = 5m;
let suspicious_run =
    DeviceRegistryEvents
    | where RegistryKey endswith @"\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
    | where RegistryValueData has_any (
        "pcalua", "mshta", "powershell", "pwsh", "rundll32",
        "regsvr32", "wscript", "cscript", "curl", "certutil",
        "msiexec", "http://", "https://"
    )
    | project
        RunTime = Timestamp,
        DeviceId,
        DeviceName,
        RunUser = InitiatingProcessAccountUpn,
        RunCommand = RegistryValueData;
let suspicious_process =
    DeviceProcessEvents
    | where FileName in~ (
        "cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe",
        "rundll32.exe", "regsvr32.exe", "wscript.exe", "cscript.exe",
        "curl.exe", "certutil.exe", "msiexec.exe", "pcalua.exe"
    )
    | where ProcessCommandLine has_any (
        "http://", "https://", "pcalua", "mshta", "curl",
        "certutil", " /i ", " /qn", "-enc", "-encodedcommand",
        "downloadstring", "invoke-webrequest"
    )
    | project
        ProcTime = Timestamp,
        DeviceId,
        ProcUser = AccountUpn,
        FileName,
        ProcessCommandLine,
        InitiatingProcessFileName,
        InitiatingProcessCommandLine;
suspicious_run
| join kind=inner suspicious_process on DeviceId
| where ProcTime between (RunTime .. RunTime + correlation_window)
| where isempty(RunUser) or isempty(ProcUser) or RunUser =~ ProcUser
| project
    RunTime,
    ProcTime,
    DeviceName,
    User = coalesce(RunUser, ProcUser),
    RunCommand,
    FileName,
    ProcessCommandLine,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine
| order by ProcTime desc

SPL

| multisearch
    [ | tstats count
        from datamodel=Endpoint.Registry
        where Registry.registry_path="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*"
        by _time Registry.dest Registry.user Registry.registry_value_data
      | rename
          Registry.dest as dest
          Registry.user as user
          Registry.registry_value_data as run_command
      | eval stage="run"
      | where match(lower(run_command),
          "(pcalua|mshta|powershell|pwsh|rundll32|regsvr32|wscript|cscript|curl|certutil|msiexec|https?://)")
    ]
    [ | tstats count
        from datamodel=Endpoint.Processes
        where
            (Processes.process_name="cmd.exe"
             OR Processes.process_name="powershell.exe"
             OR Processes.process_name="pwsh.exe"
             OR Processes.process_name="mshta.exe"
             OR Processes.process_name="rundll32.exe"
             OR Processes.process_name="regsvr32.exe"
             OR Processes.process_name="wscript.exe"
             OR Processes.process_name="cscript.exe"
             OR Processes.process_name="curl.exe"
             OR Processes.process_name="certutil.exe"
             OR Processes.process_name="msiexec.exe"
             OR Processes.process_name="pcalua.exe")
        by _time Processes.dest Processes.user Processes.process_name
           Processes.process Processes.parent_process_name
      | rename
          Processes.dest as dest
          Processes.user as user
          Processes.process_name as process_name
          Processes.process as process
          Processes.parent_process_name as parent_process_name
      | eval stage="process"
      | where match(lower(process),
          "(https?://|pcalua|mshta|curl|certutil| /i | /qn|-enc|-encodedcommand|downloadstring|invoke-webrequest)")
    ]
| sort 0 dest _time
| streamstats current=f
    last(eval(if(stage="run", _time, null()))) as run_time
    last(eval(if(stage="run", run_command, null()))) as run_command
    by dest
| where stage="process"
    AND isnotnull(run_time)
    AND _time>=run_time
    AND _time<=run_time+300
| table run_time _time dest user run_command process_name parent_process_name process
| sort - _time

What to look for

A strong match shows a suspicious Run command followed within minutes by native tooling that retrieves remote content, launches a remote script, or silently executes a downloaded package.

Technical details

Tested signal

A suspicious RunMRU command followed by a native tool that references remote content, retrieval behavior, or silent follow-on execution.

Assumptions

RunMRU registry telemetry is collected with device and initiating-user context.
Registry and process timestamps are comparable.
The selected five-minute window is reviewed and tuned for the local environment.

Data requirements and relevant fields

registry: RunMRU registry events that preserve device, user, command, and timestamp.
Timestamp
DeviceId
DeviceName
RegistryKey
RegistryValueData
InitiatingProcessAccountUpn
process: Native-tool execution with account, command line, parent process, device, and timestamp.
Timestamp
DeviceId
AccountUpn
FileName
ProcessCommandLine
InitiatingProcessFileName
InitiatingProcessCommandLine

KQL schema

Uses Microsoft Defender XDR DeviceRegistryEvents and DeviceProcessEvents. If RunMRU or initiating-user fields are unavailable, map the same analytical question to equivalent registry and process sources.

SPL schema

Requires Registry and Process telemetry mapped to Splunk CIM. Same-device and time correlation remains primary where user normalization differs.

Limitations

RunMRU population and initiating-user fields depend on endpoint telemetry.
Native tools are not malicious by themselves; approved administration and deployment activity can resemble the chain.
Same-device and time correlation is primary when user normalization is incomplete.

Both variants preserve same-device and five-minute correlation. Registry, process, and user-field normalization must be adapted to the selected endpoint source.

Analyst workflow

What the analyst should look for

Was the command entered through Windows Run?
What process or LOLBin was launched?
Did the command reference a remote URL or path?
What executed immediately afterwards?
Was a file, MSI, script, or DLL created or launched?
Did the resulting process communicate externally?
Was persistence created shortly afterwards?

Expected result

A strong match shows a suspicious Run command followed within minutes by native tooling that retrieves remote content, launches a remote script, or silently executes a downloaded package.

Investigation pivots

Drilldowns

Use the candidate context to reconstruct what executed, what changed, and what communicated next.

View query — Reconstruct the RunMRU command

What this checks

Shows RunMRU entries on the affected device and preserves the command, user and initiating-process context needed to validate user-driven execution.

KQL

let target_device = "NVV-EX-2123";
let lookback = 1d;

DeviceRegistryEvents
| where Timestamp >= ago(lookback)
| where DeviceName =~ target_device
| where RegistryKey endswith
    @"\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
| project
    Timestamp,
    DeviceName,
    RegistryKey,
    RegistryValueName,
    RegistryValueData,
    InitiatingProcessAccountUpn,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine
| order by Timestamp asc

SPL

index=<endpoint_index> sourcetype=<registry_events_sourcetype>
earliest=-1d
| eval
    device=coalesce(device, dest, host, DeviceName),
    user=lower(coalesce(user, AccountUpn, InitiatingProcessAccountUpn)),
    registry_path=coalesce(registry_path, RegistryKey, key_path),
    value_name=coalesce(value_name, RegistryValueName),
    value_data=coalesce(value_data, RegistryValueData),
    process_name=coalesce(process_name, InitiatingProcessFileName),
    process_command_line=coalesce(
        process_command_line,
        InitiatingProcessCommandLine
    )
| where device="NVV-EX-2123"
| where like(
    lower(registry_path),
    "%\software\microsoft\windows\currentversion\explorer\runmru%"
)
| fields
    _time device user registry_path value_name value_data
    process_name process_command_line
| sort 0 _time

What to look for

Remote URLs, pcalua, mshta, curl, script interpreters, encoded content, or other commands inconsistent with the user's expected activity.

Technical details

Tested signal

Recover the actual Windows Run command and user context on the affected device.

Assumptions

Registry telemetry retains RunMRU value data and initiating-process context.
NVV-EX-2123 is replaced with the candidate host returned by DET-002 when investigating another device.

Data requirements and relevant fields

registry: RunMRU registry activity from the affected device with user and initiating-process context.
Timestamp
DeviceName
RegistryKey
RegistryValueName
RegistryValueData
InitiatingProcessAccountUpn
InitiatingProcessFileName
InitiatingProcessCommandLine

KQL schema

Uses Microsoft Defender XDR DeviceRegistryEvents fields; map equivalent registry fields where required.

SPL schema

Raw or normalized SPL adaptation scaffold; replace index, sourcetype, and field aliases with the selected registry source.

Limitations

RunMRU collection and initiating-process fields depend on the endpoint source.
The explicit one-day window must be narrowed or expanded for the candidate under review.

The target device is intentionally explicit because this is an investigation drilldown, not a production detection. Replace it with the candidate host returned by DET-002.

View query — Rebuild the process chain

What this checks

Returns relevant native-tool execution and parent context on the affected device so the analyst can reconstruct the execution chain.

KQL

let target_device = "NVV-EX-2123";
let lookback = 1d;
let relevant_tools = dynamic([
    "cmd.exe",
    "powershell.exe",
    "pwsh.exe",
    "pcalua.exe",
    "mshta.exe",
    "rundll32.exe",
    "regsvr32.exe",
    "wscript.exe",
    "cscript.exe",
    "curl.exe",
    "certutil.exe",
    "msiexec.exe"
]);

DeviceProcessEvents
| where Timestamp >= ago(lookback)
| where DeviceName =~ target_device
| where FileName in~ (relevant_tools)
    or InitiatingProcessFileName in~ (relevant_tools)
| project
    Timestamp,
    DeviceName,
    AccountUpn,
    FileName,
    ProcessCommandLine,
    ProcessId,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    InitiatingProcessId,
    SHA1,
    SHA256
| order by Timestamp asc

SPL

index=<endpoint_index> sourcetype=<process_events_sourcetype>
earliest=-1d
| eval
    device=coalesce(device, dest, host, DeviceName),
    user=lower(coalesce(user, AccountUpn, account_name)),
    process_name=lower(coalesce(process_name, Image, FileName)),
    process_command_line=coalesce(
        process_command_line,
        CommandLine,
        ProcessCommandLine
    ),
    parent_process_name=lower(coalesce(
        parent_process_name,
        ParentImage,
        InitiatingProcessFileName
    )),
    parent_command_line=coalesce(
        parent_command_line,
        ParentCommandLine,
        InitiatingProcessCommandLine
    ),
    sha256=coalesce(sha256, SHA256)
| where device="NVV-EX-2123"
| where process_name IN (
    "cmd.exe",
    "powershell.exe",
    "pwsh.exe",
    "pcalua.exe",
    "mshta.exe",
    "rundll32.exe",
    "regsvr32.exe",
    "wscript.exe",
    "cscript.exe",
    "curl.exe",
    "certutil.exe",
    "msiexec.exe"
)
OR parent_process_name IN (
    "cmd.exe",
    "powershell.exe",
    "pwsh.exe",
    "pcalua.exe",
    "mshta.exe",
    "rundll32.exe",
    "regsvr32.exe",
    "wscript.exe",
    "cscript.exe",
    "curl.exe",
    "certutil.exe",
    "msiexec.exe"
)
| fields
    _time device user
    parent_process_name parent_command_line
    process_name process_command_line sha256
| sort 0 _time

What to look for

The sequence: Run/user context → pcalua/mshta → remote retrieval → msiexec or follow-on execution, plus unexpected parent-child relationships.

Technical details

Tested signal

Review process execution surrounding the suspicious Run or LOLBin activity.

Assumptions

Process events preserve command-line and parent context for the affected device.
NVV-EX-2123 is replaced with the candidate host returned by DET-002 when investigating another device.

Data requirements and relevant fields

process: Relevant native-tool process activity with parent, command-line, process identifier, and hash context.
Timestamp
DeviceName
AccountUpn
FileName
ProcessCommandLine
ProcessId
InitiatingProcessFileName
InitiatingProcessCommandLine
InitiatingProcessId
SHA1
SHA256

KQL schema

Uses Microsoft Defender XDR DeviceProcessEvents fields and preserves parent-child context.

SPL schema

Raw or normalized SPL adaptation scaffold; replace index, sourcetype, and field aliases with the selected process source.

Limitations

Short-lived processes or incomplete command lines may be absent from retained telemetry.
Native tools can have legitimate administrative uses and require full context.

For a high-volume environment, narrow the time picker around the candidate returned by DET-002 instead of searching a full day.

View query — Follow remote network activity

What this checks

Shows outbound connections from relevant native tools on the affected device and preserves the initiating command line.

KQL

let target_device = "NVV-EX-2123";
let lookback = 1d;
let relevant_tools = dynamic([
    "cmd.exe",
    "powershell.exe",
    "pwsh.exe",
    "pcalua.exe",
    "mshta.exe",
    "rundll32.exe",
    "curl.exe",
    "certutil.exe",
    "msiexec.exe",
    "RunSearch.exe"
]);

DeviceNetworkEvents
| where Timestamp >= ago(lookback)
| where DeviceName =~ target_device
| where InitiatingProcessFileName in~ (relevant_tools)
| project
    Timestamp,
    DeviceName,
    InitiatingProcessAccountUpn,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    RemoteUrl,
    RemoteIP,
    RemotePort,
    Protocol,
    LocalIP
| order by Timestamp asc

SPL

index=<endpoint_or_network_index>
sourcetype=<endpoint_network_events_sourcetype>
earliest=-1d
| eval
    device=coalesce(device, src_host, dest, host, DeviceName),
    user=lower(coalesce(
        user,
        AccountUpn,
        InitiatingProcessAccountUpn
    )),
    process_name=lower(coalesce(
        process_name,
        InitiatingProcessFileName,
        process
    )),
    process_command_line=coalesce(
        process_command_line,
        InitiatingProcessCommandLine
    ),
    remote_domain=coalesce(
        remote_domain,
        RemoteUrl,
        url_domain,
        dest_host
    ),
    remote_ip=coalesce(remote_ip, RemoteIP, dest_ip),
    remote_port=coalesce(remote_port, RemotePort, dest_port)
| where device="NVV-EX-2123"
| where process_name IN (
    "cmd.exe",
    "powershell.exe",
    "pwsh.exe",
    "pcalua.exe",
    "mshta.exe",
    "rundll32.exe",
    "curl.exe",
    "certutil.exe",
    "msiexec.exe",
    "runsearch.exe"
)
| fields
    _time device user process_name process_command_line
    remote_domain remote_ip remote_port
| sort 0 _time

What to look for

Previously unseen destinations, connections immediately following execution, and infrastructure tied to the candidate process chain.

Technical details

Tested signal

Identify external communication initiated by the suspicious execution chain.

Assumptions

Endpoint network telemetry retains initiating-process command-line context.
NVV-EX-2123 is replaced with the candidate host returned by DET-002 when investigating another device.

Data requirements and relevant fields

network: Outbound network activity with initiating-process, destination, port, protocol, and local-address context.
Timestamp
DeviceName
InitiatingProcessAccountUpn
InitiatingProcessFileName
InitiatingProcessCommandLine
RemoteUrl
RemoteIP
RemotePort
Protocol
LocalIP

KQL schema

Uses Microsoft Defender XDR DeviceNetworkEvents fields and preserves initiating-process context.

SPL schema

Raw or normalized SPL adaptation scaffold; replace index, sourcetype, and field aliases with the selected endpoint network source.

Limitations

Proxy-only visibility may not retain the endpoint process context used by this query.
Encrypted traffic and shared infrastructure require command-line and process-chain corroboration.

In environments with proxy-only visibility, adapt the destination fields and correlate the result back to endpoint process telemetry by device, user, and time.

View query — Review persistence and dropped files

What this checks

Returns Run-key persistence and ClickFix-reported dropped-file artifacts on the affected device with initiating-process context.

KQL

let target_device = "NVV-EX-2123";
let lookback = 1d;

union
(
    DeviceRegistryEvents
    | where Timestamp >= ago(lookback)
    | where DeviceName =~ target_device
    | where RegistryKey has
        @"\Software\Microsoft\Windows\CurrentVersion\Run"
    | project
        Timestamp,
        DeviceName,
        ArtifactType="Registry",
        ArtifactName=RegistryValueName,
        ArtifactValue=RegistryValueData,
        InitiatingProcessFileName,
        InitiatingProcessCommandLine,
        SHA256=""
),
(
    DeviceFileEvents
    | where Timestamp >= ago(lookback)
    | where DeviceName =~ target_device
    | where FileName in~ (
        "inst24.msi",
        "RunSearch.exe"
    )
        or FolderPath has @"\AppData\Local\Microsoft\RunSearch"
    | project
        Timestamp,
        DeviceName,
        ArtifactType="File",
        ArtifactName=FileName,
        ArtifactValue=FolderPath,
        InitiatingProcessFileName,
        InitiatingProcessCommandLine,
        SHA256
)
| order by Timestamp asc

SPL

(
    index=<endpoint_index>
    sourcetype=<registry_events_sourcetype>
    earliest=-1d
)
OR
(
    index=<endpoint_index>
    sourcetype=<file_events_sourcetype>
    earliest=-1d
)
| eval
    device=coalesce(device, dest, host, DeviceName),
    event_type=case(
        sourcetype="<registry_events_sourcetype>", "registry",
        sourcetype="<file_events_sourcetype>", "file",
        true(), "other"
    ),
    registry_path=coalesce(registry_path, RegistryKey),
    value_name=coalesce(value_name, RegistryValueName),
    value_data=coalesce(value_data, RegistryValueData),
    file_name=coalesce(file_name, FileName),
    file_path=coalesce(file_path, FolderPath),
    process_name=coalesce(
        process_name,
        InitiatingProcessFileName
    ),
    process_command_line=coalesce(
        process_command_line,
        InitiatingProcessCommandLine
    ),
    sha256=coalesce(sha256, SHA256)
| where device="NVV-EX-2123"
| where
    (
        event_type="registry"
        AND like(
            lower(registry_path),
            "%\software\microsoft\windows\currentversion\run%"
        )
    )
    OR
    (
        event_type="file"
        AND (
            lower(file_name) IN ("inst24.msi","runsearch.exe")
            OR like(
                lower(file_path),
                "%\appdata\local\microsoft\runsearch%"
            )
        )
    )
| fields
    _time device event_type
    registry_path value_name value_data
    file_name file_path sha256
    process_name process_command_line
| sort 0 _time

What to look for

Run-key values, inst24.msi, RunSearch.exe, or files under the RunSearch application path created by the candidate process chain.

Technical details

Tested signal

Identify persistence and files created by the suspicious execution chain.

Assumptions

Registry and file telemetry is available for the affected device.
NVV-EX-2123 is replaced with the candidate host returned by DET-002 when investigating another device.

Data requirements and relevant fields

registry: Run-key changes with value data and initiating-process context.
Timestamp
DeviceName
RegistryKey
RegistryValueName
RegistryValueData
InitiatingProcessFileName
InitiatingProcessCommandLine
file: ClickFix-reported filenames or paths with initiating-process and hash context.
Timestamp
DeviceName
FileName
FolderPath
InitiatingProcessFileName
InitiatingProcessCommandLine
SHA256

KQL schema

Uses Microsoft Defender XDR registry and file telemetry to combine persistence and dropped-file evidence.

SPL schema

Raw or normalized SPL adaptation scaffold; replace index, sourcetype, and field aliases with the selected registry and file sources.

Limitations

File and registry telemetry may be incomplete when collection begins after execution.
Filenames and paths are campaign-scoped pivots and require behavioral corroboration.

Replace the registry and file sourcetypes with the local endpoint sources, then normalize the artifact and initiating-process fields before applying the supplied filters.

Legitimate resemblance

What the analyst should confirm

Similar activity can be legitimate. Confirm the approved purpose and expected context before escalating.

An approved administrator uses Windows Run and native tools for documented troubleshooting.
The exact user, device, command, destination, purpose, owner, and bounded change window match an approved workflow.
An approved software-deployment workflow retrieves and silently installs a package.
The package source, signature, hash, deployment owner, management tooling, target population, and change window all agree with the candidate.
A user follows documented support guidance that invokes one of the listed native tools.
The support record, expected command, destination, user interaction, and follow-on activity explain the complete chain without unknown infrastructure or persistence.

Confirmed match

Action after a confirmed match

Isolate the affected endpoint.
Preserve the full execution chain and downloaded artifacts.
Block confirmed malicious infrastructure.
Remove confirmed persistence.
Revoke exposed sessions and credentials when browser or credential access is present.
Start a wider-environment hunt.

Threat hunt

Could this be happening elsewhere?

Hunt for this behavior across the environment.

View threat hunt

Technical boundary

Telemetry and limitations

Registry: Windows RunMRU events with device, user, value data, initiating process, and timestamp context.
Required fields
Timestamp
DeviceId
DeviceName
RegistryKey
RegistryValueName
RegistryValueData
InitiatingProcessAccountUpn
InitiatingProcessFileName
InitiatingProcessCommandLine
Process: Process creation events with device, account, image, command line, parent image, parent command line, and timestamp.
Required fields
Timestamp
DeviceId
DeviceName
AccountUpn
FileName
ProcessCommandLine
ProcessId
InitiatingProcessFileName
InitiatingProcessCommandLine
InitiatingProcessId
SHA1
SHA256
Network: Optional enrichment for destinations contacted by the candidate process chain.
Required fields
Timestamp
DeviceId
DeviceName
InitiatingProcessAccountUpn
RemoteUrl
RemoteIP
RemotePort
Protocol
LocalIP
InitiatingProcessFileName
InitiatingProcessCommandLine
File: Optional enrichment for downloaded or created scripts, packages, DLLs, and executables.
Required fields
Timestamp
DeviceId
DeviceName
FileName
FolderPath
SHA256
InitiatingProcessFileName
InitiatingProcessCommandLine

Behavior mapping

MITRE ATT&CK

T1204.004 · Malicious Copy and Paste
The analytic begins with evidence that a user pasted an attacker-supplied command into Windows Run.
T1218.005 · Mshta
Mshta is one native execution path correlated after suspicious Run activity.
T1218.007 · Msiexec
Msiexec is one follow-on path for silently launching a retrieved package.
T1105 · Ingress Tool Transfer
The analytic looks for remote retrieval immediately after user-driven execution.
T1547.001 · Registry Run Keys / Startup Folder
New Run-key persistence raises confidence after the initial correlation.

Mappings describe the behavior examined by this analytic. They do not prove attribution, deployment, or technique-wide coverage.

Review boundary

Sources and limits

External sources: 8

Exact fields, retention, and operational thresholds remain environment-specific.

Sections

What it detects
Why this detection
Detection logic
Query
Review
Drilldowns
Confirm
Response
Hunt
Coverage

What it detects

Why this detection

Detection logic

Query

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

What the analyst should look for

Expected result

Drilldowns

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

What the analyst should confirm

Action after a confirmed match

Could this be happening elsewhere?

Telemetry and limitations

Blind spots

MITRE ATT&CK

Sources and limits